AEGISGRID

SOC Alert Triage · Deep Dive

Alert fatigue is the failure mode of modern security operations.

AegisGrid sits between your SIEM and your ServiceNow queue. It enriches each alert with on-prem context, produces a triage decision tree with explicit reasoning, and either escalates with full lineage or auto-closes with a hash-chained audit entry. The analyst stays in command. The alert noise goes down.

§ 01 — The SOC Reality

Over-notified. Under-staffed. Vendor-side risk upstream and downstream.

The modern SOC is over-notified and under-staffed. Industry analyst consensus in 2025–2026 puts the modern SOC alert-reduction target at 70–80% — meaning an operation that is functioning at the level institutional leadership demands needs to demonstrate roughly that reduction in alert volume reaching human queues. AegisGrid is designed to deliver that reduction through enrichment and reasoning, not through suppression: alerts are not dropped, they are routed with an explicit audit trail that says what the agent decided and why.

In May 2026, the threat actor ShinyHunters claimed responsibility for a breach of Instructure's Canvas LMS environment that rippled across U.S. higher education, including a documented impact at Rutgers. Rutgers' IT department issued a public alert acknowledging the incident; the Daily Targum and NJ 101.5 both reported on it. The incident is a textbook example of a third-party SaaS breach that bypasses institutional perimeter controls — the vendor's credentials were the attack surface. AegisGrid's role in incidents like this is upstream (third-party risk review under HECVAT 4) and downstream (alert triage when vendor-side incidents generate signal in the institutional SIEM). Both workflows share the same architecture: local inference, signed audit log, human in command.

Sources: Rutgers IT alert — it.rutgers.edu/alerts/2026/05/04/nationwide-security-breach-involving-canvas/; Daily Targum coverage; NJ 101.5 coverage.

Case study

May 2026 — ShinyHunters / Instructure Canvas breach

Incident
Third-party SaaS breach of Instructure's Canvas LMS, with downstream impact at U.S. higher-education institutions including Rutgers.
Date
May 2026
Threat actor
ShinyHunters

A textbook third-party SaaS breach that bypasses institutional perimeter controls — the vendor's credentials were the attack surface. AegisGrid's upstream and downstream workflows share the same architecture: local inference, signed audit log, human in command.

Sources: Rutgers IT alert (it.rutgers.edu/alerts/2026/05/04/nationwide-security-breach-involving-canvas/); Daily Targum coverage; NJ 101.5 coverage.

  • 100+

    Firewalls managed by the Rutgers Security Operations Center.

    Source: Rutgers ISO, it.rutgers.edu/information-security/security-operations-center/.

  • 70–80%

    Modern SOC alert-reduction target, per industry analyst consensus in 2025–2026. (A specific Gartner report reference could not be verified; language is intentionally non-specific.)

    Source: industry analyst consensus, 2025–2026.

  • Third-party SaaS

    The ShinyHunters group is reported to have demanded ransom in a series of higher-education breaches; specific dollar figures vary by report.

    Source: Daily Targum coverage; NJ 101.5 coverage.

§ 02 — How AegisGrid Handles It

Four steps. Every alert gets a reasoning chain.

Each step is a discrete agent with explicit tool scope. Every action is signed and appended to the hash-chained audit log.

  1. 01

    Ingest

    AegisGrid accepts alerts from Splunk, Microsoft Sentinel, or Elastic in their native webhook formats. Alerts flow into the on-prem AegisGrid runtime over a signed mTLS channel. There is no cloud relay — the SIEM connector talks to the AegisGrid host on your network.

    POST /siem/ingest · mTLS · JWT (HS256, 60s ttl)
  2. 02

    Enrich

    The enrichment agent correlates the alert with on-prem context: asset inventory, identity context (without sending identity data off-host), vulnerability scan results, and locally cached threat intel. All enrichment happens inside the perimeter. The agent never queries a commercial threat-intel API as part of its decision path.

    ctx ← asset_db ∪ vuln_scans ∪ local_ti_feed
  3. 03

    Reason

    The reasoning agent — a deterministic agent swarm running against the local LLM — produces a triage decision tree with an explicit reasoning chain at each node. The output is structured: a recommendation (escalate / auto-close / hold-for-context), the evidence used, and the confidence score. Nothing is opaque.

    decision = escalate | auto_close | hold · confidence ∈ [0,1]
  4. 04

    Escalate

    Escalated alerts route into the analyst's ServiceNow queue with the full reasoning chain attached as work notes. Auto-closed alerts are recorded as a hash-chained audit entry with the same chain attached — every closure is auditable, every closure is replayable, and the analyst can override an auto-close at any time.

    servicenow.create_incident(payload) OR audit.append(hash_chain_entry)

Reference architecture

The Embed Security case study at the University of Montana documents a SOC architecture pattern — local enrichment, automated triage, auditable decision chains — in production at a higher-education institution. AegisGrid is not Embed Security and is not deployed at the University of Montana. The case study is referenced here because it demonstrates that the architecture pattern AegisGrid implements is operational in higher-ed environments today.

Source: Embed Security / University of Montana public case study.

§ 03 — The Containment Switch

A millisecond-time kill switch for every agent tool session.

What happens if the agent goes wrong? In a university SOC, the answer cannot be "page the vendor." AegisGrid exposes a millisecond-time containment primitive that revokes agent tool authority immediately. The pattern follows the published architecture guidance in CSA's Agentic AI Governance, Accountability, Trust, and Ethics (AAGATE) framework (December 2025) and the threat-model patterns in MITRE ATLAS v5.1.0 (the December 2024 ATLAS release). AegisGrid is not certified to AAGATE — the architecture follows the published pattern.

The containment switch is a single authorized action — by the CISO, the SOC director, or a designated break-glass role — that revokes the runtime credentials of every active agent session. From the moment the switch is thrown, no agent tool call will execute until the switch is reset. The action itself is logged as an audit event. The pattern is designed for the "what if the agent hallucinates an action against a critical asset" scenario, and it is designed to be reachable in milliseconds, not minutes.

CISO Containment Switch

Armed

state = ARMED · agent.tool_authority = ENABLED · audit.last = (none)

Concept demo. This widget renders the architectural pattern AegisGrid exposes in production — millisecond-time revocation of every active agent tool session — not a live connection to a deployed system.

§ 04 — Human-in-Command

Human-in-command. Never human-out-of-loop.

AegisGrid's architecture assumes the human is always in command. The agent produces a recommendation; the human approves, edits, or rejects it. Auto-closures are scoped to low-risk alerts under a published confidence threshold, and every auto-closure is replayable and overridable. The CISO retains the millisecond containment switch at all times. There is no mode in which AegisGrid operates without a designated human authority over its actions.

Recommendation only

Agents produce a triage decision; the analyst approves, edits, or rejects.

Scoped auto-closures

Low-risk alerts under a published confidence threshold; every closure is replayable.

CISO retains the switch

Millisecond containment is always available; no agent runs without a human authority.

See your hardest alert class run through AegisGrid in a 60-minute working session.

Takes you to /proof for the document-handling safety disclosures and calendar embed.

Submit a Redacted Alert PackRead the Architecture Deep Dive